Is it possible to set up the SA-SPLICE app MongDB connection to point directly to the SoltraEdge MongoDB?

[Ovi]

I am wondering if it would be possible to just set up the SPLICE app MongoDB connection to point directly to the SoltraEdge MongoDB? Basically let Soltra do all the TAXII work and have Splunk query directly the Soltra DB and avoid having to set up and maintain a separate MongoDB instance.
Would that be possible/advisable or it will not work and why?
Thanks

[cleroux_splunk · Accepted solution]

Short answer, no.

Soltra Edge has its own schema and Splice do not know anything about it. That's exactly why protocol such as TAXII have been developed. What you can do is having your Soltra Edge collecting one or multiple TAXII feeds and then Splice or Splunk Enterprise Security will collect the aggregated results through TAXII.

Enterprise Security leverage the KV Store to store IOCs so you don't have to maintain a separate mongo instance (and they are no plans for Splice to migrate to the KV Store at the moment).

[Ovi]

Thanks Cedric. It makes sense.
I just wanted to confirm my understanding before putting forward the solution design